基於API解析及運用深度學習的工業自動化及控制系統惡意軟體偵測機制

Malware Detection Mechanisms for Industrial Automation and Control Systems Based on API Analysis and Deep Learning

林詠章(Iuon-Chang Lin) ； 馬毅凱(Yi-Kai Ma)

《科儀新知》 234期 (2023/03) Pp. 44-50

摘要

隨著智慧製造應用的快速發展，智慧化的同時也帶來了一些潛在的資安風險，像是工業自動化及控制設備受到像勒索病毒等惡意軟體的威脅。因此，工控場域的端點防禦機制成為確保工控場域能否可靠運作的重要關鍵。本文將針對智慧製造場域之端點防護提出惡意軟體的偵測機制，透過沙盒環境萃取軟體之系統API呼叫序列並找出序列前後的潛在關係，進而利用深度學習來建立惡意軟體偵測模型，此機制可避免惡意程式透過變種來躲過相關偵測，有效降低智慧場域內端點設備的資安威脅。

並列摘要

With the rapid development of smart manufacturing applications, intelligence also brings some potential security risks, such as industrial automation and control equipment being threatened by malicious software such as ransomware. Therefore, the endpoint defense mechanism of the industrial control field has become an important key to ensure the reliable operation of the industrial control field. This paper will propose a malware detection mechanism for endpoint protection in the smart manufacturing field. We extract the system API call sequence of the software through the sandbox environment and find out the potential relationship before and after the sequence. Then use deep learning to build a malware detection model. This mechanism can prevent malicious programs from evading detection through variants, and effectively reduce the threat to the security of endpoint devices in the smart manufacturing field.